diff options
Diffstat (limited to 'meta/recipes-support/gpgme/gpgme-1.4.3/gpgme-fix-CVE-2014-3564.patch')
| -rw-r--r-- | meta/recipes-support/gpgme/gpgme-1.4.3/gpgme-fix-CVE-2014-3564.patch | 56 |
1 files changed, 56 insertions, 0 deletions
diff --git a/meta/recipes-support/gpgme/gpgme-1.4.3/gpgme-fix-CVE-2014-3564.patch b/meta/recipes-support/gpgme/gpgme-1.4.3/gpgme-fix-CVE-2014-3564.patch new file mode 100644 index 0000000000..c728f58658 --- /dev/null +++ b/meta/recipes-support/gpgme/gpgme-1.4.3/gpgme-fix-CVE-2014-3564.patch @@ -0,0 +1,56 @@ +Upstream-Status: Backport + +Backport patch to fix CVE-2014-3564. + +http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=commit;h=2cbd76f7911fc215845e89b50d6af5ff4a83dd77 + +Signed-off-by: Kai Kang <kai.kang@windriver.com> +--- +From 2cbd76f7911fc215845e89b50d6af5ff4a83dd77 Mon Sep 17 00:00:00 2001 +From: Werner Koch <wk@gnupg.org> +Date: Wed, 30 Jul 2014 11:04:55 +0200 +Subject: [PATCH 1/1] Fix possible realloc overflow for gpgsm and uiserver + engines. + +After a realloc (realloc is also used for initial alloc) the allocated +size if the buffer is not correctly recorded. Thus an overflow can be +introduced by receiving data with different line lengths in a specific +order. This is not easy exploitable because libassuan constructs the +line. However a crash has been reported and thus it might be possible +to constructs an exploit. + +CVE-id: CVE-2014-3564 +Reported-by: Tomáš Trnka +--- + src/engine-gpgsm.c | 2 +- + src/engine-uiserver.c | 2 +- + 3 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/src/engine-gpgsm.c b/src/engine-gpgsm.c +index 8ec1598..3a83757 100644 +--- a/src/engine-gpgsm.c ++++ b/src/engine-gpgsm.c +@@ -836,7 +836,7 @@ status_handler (void *opaque, int fd) + else + { + *aline = newline; +- gpgsm->colon.attic.linesize += linelen + 1; ++ gpgsm->colon.attic.linesize = *alinelen + linelen + 1; + } + } + if (!err) +diff --git a/src/engine-uiserver.c b/src/engine-uiserver.c +index 2738c36..a7184b7 100644 +--- a/src/engine-uiserver.c ++++ b/src/engine-uiserver.c +@@ -698,7 +698,7 @@ status_handler (void *opaque, int fd) + else + { + *aline = newline; +- uiserver->colon.attic.linesize += linelen + 1; ++ uiserver->colon.attic.linesize = *alinelen + linelen + 1; + } + } + if (!err) +-- +2.1.4 |